00ca05b6ce5db084f4466a7ccb110e349c7082189a97983577e933932ec29b5d

Analysis

max time kernel
37s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Improve Your Communication Skills (Sunday Times Creating Success.exe
Size 5.4MB
Sample260910-dj115sdq7s
SHA256 00ca05b6ce5db084f4466a7ccb110e349c7082189a97983577e933932ec29b5d
MD5 180c543a0c5404fd10d77a472ad3c2d8
SHA1 56ca545163cab9857eb58bc74b9a7b4a45e22eaa
SHA512 9aa8e86321d74f744de921b1c40f0b30785227a1c6535deabc8023dab88a711b9336a416c5f9d3cf2b8ba08ec8517884abecd15dad5046b13b47b32b3791764f
SSDEEP 1536:1uRtJUAwTe5IIegIjWUa4twIoR+f55BMEdOgT:1uRtJgTe5IPWU3siSLgT
TLSH
T1B6468D089BE70923F4960D789AE142E14BFDEC037A93E72FDF94010856E65AC9591FF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
4900	svchost.exe
5188	svchost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Auto Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Systems\\svchost.exe"	jaffacakes118_Improve Your Communication Skills (Sunday Times Creating Success.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Auto Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Systems\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Auto Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Systems\\svchost.exe"	svchost.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1216	cmd.exe
4152	cmd.exe
2356	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Improve Your Communication Skills (Sunday Times Creating Success.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	jaffacakes118_Improve Your Communication Skills (Sunday Times Creating Success.exe
Token: SeDebugPrivilege	4900	svchost.exe
Token: SeDebugPrivilege	5188	svchost.exe
Token: SeRestorePrivilege	4256	dw20.exe
Token: SeBackupPrivilege	4256	dw20.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2356	4512	jaffacakes118_Improve Your Communication Skills (Sunday Times Creating Success.exe	89
PID 4512 wrote to memory of 4900	4512	jaffacakes118_Improve Your Communication Skills (Sunday Times Creating Success.exe	92
PID 4900 wrote to memory of 1216	4900	svchost.exe	94
PID 5188 wrote to memory of 4152	5188	svchost.exe	96
PID 5188 wrote to memory of 4256	5188	svchost.exe	99

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Improve Your Communication Skills (Sunday Times Creating Success.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Improve Your Communication Skills (Sunday Times Creating Success.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delete.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2356
- C:\Users\Admin\AppData\Roaming\Adobe Systems\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Adobe Systems\svchost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delete.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1216
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 2044
    3⤵
    PID:5268

C:\Users\Admin\AppData\Roaming\Adobe Systems\svchost.exe
"C:\Users\Admin\AppData\Roaming\Adobe Systems\svchost.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delete.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4152
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 1448
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

delete.bat

Path C:\Users\Admin\AppData\Local\Temp\delete.bat
Size 160B
SHA256 16c576adcc06fe22fecc96d401866248d79fd91f34681d04edd82f7ce46476cb
MD5 4167334562645c3a877a3e3b4f570e10
SHA1 f528c7602e946584dfe440930181b1ea2f3b3850
SHA512 744f41827c7d046a08349434398d56e733693d869b5cd98a857d8439b903cab47ac9bacf0cd103b4ce75e3fa5d8a816c81bfcb1aaca84293796ed3ab6e54d320
TLSH
T173C04C3142D5C74EDC4544AB0FF5908B81B5C9D32A857A9DD74644BC758840DE9A7151
MD5 SHA1 SHA512 TLSH

Submit Download

delete.bat

Path C:\Users\Admin\AppData\Local\Temp\delete.bat
Size 280B
SHA256 0b410cf1271e1aff01b2b26459bd1b598e729a9cef0073d01ff61cc0e5c3cf3d
MD5 ce7a624391fe3aabae1542aa01cc583f
SHA1 752d80ad2f07bdf13ca198809b3661f7be59367b
SHA512 ab86445966ad1c8b3f74a80e29a43e7bda5448144cc248623db52dac1fe8f62c82ac1bc30700fa7cce83f566f86cbe89d50146e5db4027ff5077ff9b22a3aa8b
TLSH
T116D0C2AAC0958D4A095088FB77B213C8B4615B9A3A952B20AB23C288234547BB387E19
MD5 SHA1 SHA512 TLSH

Submit Download

Set.bin

Path C:\Users\Admin\AppData\Roaming\Adobe Systems\Set.bin
Size 6B
SHA256 fb0bb9b459e9427ca389ae47d4fb39b907b586f42b61a43c6c9456826b212fd9
MD5 e210dd025cba15e5b66ed84e9a2eab6d
SHA1 821fb8f2b45f58fe561ddfdfbdb57c1cc42d02ff
SHA512 2302de92049650d95df4c1bf5aada16a4bef4b1cc508c3eea789915ae52bd37a3644feadd3cebeb7a0544166ba1bf1998e5ce4e1ae601e9d880186399006fc2a
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\Adobe Systems\svchost.exe
Size 5.4MB
SHA256 00ca05b6ce5db084f4466a7ccb110e349c7082189a97983577e933932ec29b5d
MD5 180c543a0c5404fd10d77a472ad3c2d8
SHA1 56ca545163cab9857eb58bc74b9a7b4a45e22eaa
SHA512 9aa8e86321d74f744de921b1c40f0b30785227a1c6535deabc8023dab88a711b9336a416c5f9d3cf2b8ba08ec8517884abecd15dad5046b13b47b32b3791764f
SSDEEP 1536:1uRtJUAwTe5IIegIjWUa4twIoR+f55BMEdOgT:1uRtJgTe5IPWU3siSLgT
TLSH
T1B6468D089BE70923F4960D789AE142E14BFDEC037A93E72FDF94010856E65AC9591FF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4512-9-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

memory/4512-0-0x0000000000F80000-0x0000000000F90000-memory.dmp

Download

memory/4512-2-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

memory/4512-1-0x0000000074B62000-0x0000000074B64000-memory.dmp

Download

memory/4900-28-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

memory/4900-8-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

memory/4900-11-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

memory/4900-32-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

memory/4900-10-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

memory/4900-29-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

memory/5188-18-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

memory/5188-27-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

memory/5188-17-0x0000000074B60000-0x0000000075181000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads